Re: debbie-dealz / frosty-saver / got-hyrda / aero-dog spam

2007-09-12 Thread Brian Wilson
On Wed, 12 Sep 2007, Brian Wilson wrote: I've somehow made it onto spam list that isn't being picked up by RBLs or by bayes. All messages have a url that looks like this (where X's are all digits): http://aero-dog.com/1-23-28276-45381XXX.html All messages are originati

debbie-dealz / frosty-saver / got-hyrda / aero-dog spam

2007-09-12 Thread Brian Wilson
I've somehow made it onto spam list that isn't being picked up by RBLs or by bayes. All messages have a url that looks like this (where X's are all digits): http://aero-dog.com/1-23-28276-45381XXX.html All messages are originating from 206.131.x.x and I have been submitting them to spa

RE: AWL Troubles

2007-05-07 Thread Brian Wilson
On Mon, 7 May 2007, Abba Communications - www.abbacomm.net wrote: Thanks for the advise. Is there a way to view the contents of the AWL? How do I remove the table? Go into your source directory Mail-SpamAssassin-3.2.0/tools and look for check_whitelist. This will dump the contents of

Re: Alternative to red.uribl.com?

2007-04-06 Thread Brian Wilson
On Apr 6, 2007, at 2:12 AM, Bill Landry wrote: ram wrote the following on 4/5/2007 10:23 PM -0800: On Wed, 2007-04-04 at 08:11 -0700, Bill Landry wrote: ram wrote the following on 4/4/2007 12:56 AM -0800: On Tue, 2007-04-03 at 13:15 -0700, Bill Landry wrote: Dave Pooser wrote the follow

Re: bayes autolearn only on non image mails

2007-03-31 Thread Brian Wilson
On Mar 31, 2007, at 11:06 AM, ram wrote: Can I configure SA to autolearn only on non image mails. Prbably use in conjunction with the LARGO rulesets If a mail contains an image , this could probably be an image spam and I dont want to learn words from here and poison my database There w

Re: could someone run these messages....

2007-03-26 Thread Brian Wilson
On Mon, 26 Mar 2007, maillist wrote: The only tests that they score for me are BAYES_99, which should be enough to get them sent to my spam-drop, but they get to the users instead. When I --lint -D I don't see anything that tells me that I have a config problem. I start spamd this way, as

Re: Who is emaildirect.com and CIHost?

2007-03-24 Thread Brian Wilson
On Mar 24, 2007, at 3:35 PM, Gene Heskett wrote: On Saturday 24 March 2007, jdow wrote: I was recently on the receiving end of an ssh attack (which had less chance of success than a nitrocellulose cat in a traditional hell of succeeding) from CIHost. And now I received a spate of low scoring

Re: Problem with forwarding and SPF

2007-03-19 Thread Brian Wilson
On Mar 19, 2007, at 5:22 AM, Paul Hurley wrote: Hello all, Happy Pi day for last week... I'm running Spam Assassin V3.1.7.0 via SAProxy for Win32 (http:// sourceforge.net/projects/sawin32/). I've recently implemented SPF for my domain, which is working well. However I ahve a problem wit

Re: Can't Locate Tie/Handle.pm

2007-03-16 Thread Brian Wilson
On Fri, 16 Mar 2007, John D. Hardin wrote: On Fri, 16 Mar 2007, Marc Perkel wrote: Getting this error: Can't Locate Tie/Handle.pm Where do I find this and how do you figure out where to find it? ...doesn't the SA documentation or wiki have a list of required CPAN dependencies somewhere in

Re: Low Scoring Message

2007-03-14 Thread Brian Wilson
On Mar 14, 2007, at 7:08 PM, Daryl C. W. O'Shea wrote: Brian Wilson wrote: On Wed, 14 Mar 2007, John D. Hardin wrote: On Wed, 14 Mar 2007, Daryl C. W. O'Shea wrote: Anyway... this is the redirect code they're using: yvxj = "ef=";kacm = "ttp://&quo

Re: Low Scoring Message

2007-03-14 Thread Brian Wilson
On Wed, 14 Mar 2007, John D. Hardin wrote: On Wed, 14 Mar 2007, Daryl C. W. O'Shea wrote: Anyway... this is the redirect code they're using: yvxj = "ef=";kacm = "ttp://";apgy = "fe";ioo = "'h";usf = "ershikin";uos = ".";iaswx = "inj";bdj = "com'";rpul = "l";fgbww = "nhu";wnx = "ocati

Re: Low Scoring Message

2007-03-14 Thread Brian Wilson
On Wed, 14 Mar 2007, Daryl C. W. O'Shea wrote: Brian Wilson wrote: Ok, I've got one; apparently from a gmail user to my gmail account, then forwarded to an external account. The html links go to a blogspot.com site, then redirect to some Pharmacy Express site. Raw Mes

Low Scoring Message

2007-03-14 Thread Brian Wilson
Ok, I've got one; apparently from a gmail user to my gmail account, then forwarded from my gmail account to an external account. The html links go to a blogspot.com site, then redirect to some Pharmacy Express site. Raw Message: http://bubba.org/spam/spam_lowscore.txt Message renders like t

Re: Low Scoring Message

2007-03-13 Thread Brian Wilson
Ok, I've got one; apparently from a gmail user to my gmail account, then forwarded to an external account. The html links go to a blogspot.com site, then redirect to some Pharmacy Express site. Raw Message: http://bubba.org/spam/spam_lowscore.txt Message renders like this: http://bubba.or

Re: Sorting SA Discussion List Messages

2007-03-03 Thread Brian Wilson
On Mar 3, 2007, at 4:41 PM, Mário Gamito wrote: Don Ireland wrote: Every email list I've ever subscribed to has had something in the subject line (usually in square brackets) to identify 1) that it is a mailing list and 2) what list it is. Maybe, just maybe, you can filter through e-mail ad

Re: Using sa-learn and fetchmail

2007-02-27 Thread Brian Wilson
On Feb 27, 2007, at 5:59 AM, Matthew Bickerton wrote: Hi all, As described in the SA wiki, I have set up fetchmail to read a mail folder in to sa-learn. However I get the following error: /usr/local/bin/fetchmail -a -s -n --uidl --keep --folder LearnAsSpam -m '/usr/local/bin/sa-learn --

Re: how to start using sa-update

2007-02-25 Thread Brian Wilson
On Feb 25, 2007, at 3:24 PM, John Fleming wrote: - Original Message - From: "David Goldsmith" <[EMAIL PROTECTED]> To: "Bram Mertens" <[EMAIL PROTECTED]> Cc: Sent: Sunday, February 25, 2007 2:10 PM Subject: Re: how to start using sa-update -BEGIN PGP SIGNED MESSAGE- Hash:

Re: Crooked JPG's not being recognized by FuzzyOCR?

2007-02-25 Thread Brian Wilson
On Feb 25, 2007, at 2:29 PM, David Goldsmith wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ok, I had a permissions issue on some of the FuzzyOCR files so it couldn't properly parse it. Now that the permissions are fixed, my system is catching that image. SA results are: X-Spam-Report

Re: FuzzyOcr - how do I "teach" it?

2007-02-24 Thread Brian Wilson
On Feb 20, 2007, at 6:36 PM, Robert S wrote: I have just installed FOCR 3.5.1 with the hashdb option. I have been receiving image spams about China Fruits Corporation which are cleverly designed not to contain words in the words list. How do I insert the hash into the database and label this

RE: FuzzyOcr image spam not getting scored

2007-02-23 Thread Brian Wilson
On Fri, 23 Feb 2007, Randal, Phil wrote: Charming! Being part of a large community on this mailing list, my answer was addressing all readers and not just you. So I included the extra info for those readers who scanned your email and found low SA scores regardless. What FuzzyOCR scanset did y

RE: FuzzyOcr image spam not getting scored

2007-02-23 Thread Brian Wilson
On Fri, 23 Feb 2007, Randal, Phil wrote: I caught these by adding corpo to my FuzzyOCR.words file. But you should also br running a bunch of SARE rules, and sa-updated rulesets. Wow, thanks for not reading my email or reading the scores in the message I posted. As I originally noted, the

Re: Fwd: FuzzyOcr - how do I "teach" it?

2007-02-23 Thread Brian Wilson
On Fri, 23 Feb 2007, Jorge Valdes wrote: Brian Wilson wrote: On Feb 20, 2007, at 6:36 PM, Robert S wrote: I have just installed FOCR 3.5.1 with the hashdb option. I have been receiving image spams about China Fruits Corporation which are cleverly designed not to contain words in the words

Fwd: FuzzyOcr - how do I "teach" it?

2007-02-23 Thread Brian Wilson
On Feb 20, 2007, at 6:36 PM, Robert S wrote: I have just installed FOCR 3.5.1 with the hashdb option. I have been receiving image spams about China Fruits Corporation which are cleverly designed not to contain words in the words list. How do I insert the hash into the database and label this i

FuzzyOcr image spam not getting scored

2007-02-23 Thread Brian Wilson
Passing this along in case someone has a scanset that is able to pick this one up. Yes, it was tagged as spam from other rules, but I got nothing from FuzzyOcr on it. http://bubba.org/spam/imagespam12.gif http://bubba.org/spam/imagespam12.txt -B

Re: Be bumblebee do shaft

2007-02-22 Thread Brian Wilson
On Feb 22, 2007, at 6:06 AM, Loren Wilton wrote: Your best bets at the moment are FuzzyOCR and the SARE_STOCKS ruleset. FuzzyOCR would have a real good chance of catching that image. You didn't include the headers, so it is hard to say what is in there. If you aren't running the net rul

Re: New stock spam (2/14/07)

2007-02-14 Thread Brian Wilson
On Feb 14, 2007, at 8:48 PM, Giampaolo Tomassoni wrote: From: Quinn Comendant [mailto:[EMAIL PROTECTED] On Thu, 15 Feb 2007 01:18:46 +0100, Giampaolo Tomassoni wrote: I think SARE and some network tests are even better (scores 11.5 with my surprising Bayes :) I agree, mine scored it in a